Support

Akeeba Backup for Joomla!

#11985 support for configuration.php outside public_html

Posted in ‘Akeeba Backup for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Akeeba Backup version
n/a

Latest post by nicholas on Saturday, 14 April 2012 12:08 CDT

Friday, 13 April 2012 20:13 CDT

zott
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? No
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? No
Joomla! version: 2.5.4
PHP version: 5.3.10
MySQL version: 5.1.61
Host: Dedicated on Softlayer, all security options
Akeeba Backup version: always the latest stable

EXTREMELY IMPORTANT: Please attach a ZIP file containing your Akeeba Backup log file in order for us to help you with any backup or restoration issue. If the file is over 2Mb, please upload it on your server and post a link to it.

Description of my issue:

Hi Again Nicholas.

Each time we talk, some dormant questions pop up on my mind.

Since I bought RS Firewall, all my Joomla sites are using temp, log and configuration.php outside public_html.

I had to restore some sites since I began doing that, and there is always the extra step of backup configuration.php in separate, change it manually, and restore it outside public_html.

I know that outside public_html is kind of "out of reach", that's why it is secure, but I'm wondering: is there a way for Akeeba Backup support backup and restore of Joomla with this kind of security setting?

Maybe there is a need for, let's say, providing the main FTP (in a very very disposable way, stored for only a few steps of the restore proccess) for the account on the restore proccess, so Akeeba Backup can reach outside, or something else entirely tha can extend akeeba's reach (I'm not a programmer, so my "wondering" power is limited).

And if it is possible, maybe you can even start encouraging Joomla users to take this extra step, and even providing a way inside Admin Tools to users so they can "flip the switch" between configuration.php inside or outside public_html (and even help moving temp and log altogether). And since Akeeba Backup and Admin Tools store the configs encrypted, it can store the master FTP account encrypted too, or even better, store configuration.php encrypted (even outside)?

OK, wondering time is over. I hope my imagination is good enough, and I'm coherent enough, for you to take advantage of something in all this.

Best regards.

Jonathan

Jonathan Roza www.zott.com.br

Saturday, 14 April 2012 02:50 CDT

nicholas
I consider moving the configuration.php around a very ineffective means of security which only makes it more difficult for the webmaster to administer his site, causing more harm in the long run.

To put it bluntly, moving the configuration.php file outside of your site's root is useless if the attacker obtains FTP access (or can execute code inside Joomla!'s or your site's context) as he can read it from anywhere it's stored. If the attacker runs arbitrary code in your site, it's easy to include Joomla!'s defines.php file, instantiate JConfig and var_dump() it. The bottom line is that as long as this file is readable by Joomla! its contents can be dumped. The only thing you achieve by moving outside of the site's root is to make your life difficult and cause some tools, like Akeeba Backup, not work properly.

Regarding making the configuration.php file more difficult to write to, yes, moving it outside of your site's root will work if you have properly set up ownership and permissions, use a different FTP user for your site which only has access to your site's root (not any levels above it) and you don't mind editing the file directly over FTP every time you need to change any little thing. On the other hand, as an attacker, if I gain write access to your site (e.g. by dumping the contents of your configuration.php file as I explained above), I can simply modify your JPATH_CONFIGURATION to point somewhere deep inside your site, write my own malicious configuration.php and completely, absolutely, very easily bypass your hard-to-write configuration.php file.

In any case, I can pwn your site with the relative difficulty of a walk in the park. So, please, don't ask me to implement something which gives a false sense of security and causes a host of problems to other software, because I'm not going to do it ;)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Saturday, 14 April 2012 09:55 CDT

zott
Hi Nicholas.

OK, consider me officially astounded.
If you can find the time, can you recommend me 2 or 3 pieces of serious reading so I can start to delve deeper into joomla security practices?

Thank's again for your straight to the point sincerity. I really appreciate it.

Jonathan

Jonathan Roza www.zott.com.br

Saturday, 14 April 2012 10:03 CDT

nicholas
Hi Jonathan,

I don't think there is a reliable, comprehensive guide on security written yet. I only know of one security book for Joomla!, but it may be a little over the average person's head. I've tried to write as many articles as I can on site security both on my blog and the Joomla! Community Magazine. Brian Teeman also has some occasional and very useful security advice in his blog. That's all I can think of right now :)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Saturday, 14 April 2012 10:26 CDT

zott
Hi Nicholas.

Thank you for the recommendations.
If you can name that book, I will start building knowledge in the right direction, in the hope I can read it soon.

Thank's again, and best regards.

Jonathan

Jonathan Roza www.zott.com.br

Saturday, 14 April 2012 12:08 CDT

nicholas
It's "Joomla! Web Security" by Tom Canavan (published by Packt Publishing). It's an almost 4-years-old book and some parts may not be very relevant any more.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!